Updated 1 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,773exploited flaws on CISA’s list

34added in the last 30 days

518new WordPress flaws this week

395,110entries in the database

5,578 results · page 68 of 112

Dec 18, 2023SmartCrawl: Does not prevent unauthorised users from accessing password-protected posts' contentCVE-2023-5949 · WordPress plugins & themes · reported by WPScanHigh 7.5
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
Product
SmartCrawl
Fixed in
3.8.3
What to do
Update SmartCrawl to 3.8.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5886 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers with the ability to upload files to make logged in users perform unwanted actions leading to PHAR deserialization, which may lead to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not check nonce tokens early enough in the request lifecycleCVE-2023-5882 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution.
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Product Catalog Mode For WooCommerce: Does not properly authorize settings updates or escape settings valuesCVE-2023-5348 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Product Catalog Mode For WooCommerce WordPress plugin before 5.0.3 does not properly authorize settings updates or escape settings values, leading to stored XSS by unauthenticated users.
Product
Product Catalog Mode For WooCommerce
Fixed in
5.0.3
What to do
Update Product Catalog Mode For WooCommerce to 5.0.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro: Does not sanitise and escape some of its settingsCVE-2023-5005 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro
Fixed in
3.0
What to do
Update Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro to 3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 18, 2023Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro: Does not validate and sanitise the `wp_query` parameterCVE-2023-4724 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the `wp_query` parameter which allows an attacker to run arbitrary command on the remote server
Product
Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro
Fixed in
1.4.0
What to do
Update Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023EazyDocs: Does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX actionCVE-2023-6035 · WordPress plugins & themes · reported by WPScanHigh 8.8
The EazyDocs WordPress plugin before 2.3.4 does not properly sanitize and escape "data" parameter before using it in an SQL statement via an AJAX action, which could allow any authenticated users, such as subscribers, to perform SQL Injection attacks.
Product
EazyDocs
Fixed in
2.3.4
What to do
Update EazyDocs to 2.3.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023Contact Form Email: Does not sanitise and escape some of its settingsCVE-2023-5955 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Contact Form Email WordPress plugin before 1.3.44 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Contact Form Email
Fixed in
1.3.44
What to do
Update Contact Form Email to 1.3.44 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023WP Not Login Hide (WPNLH): Does not sanitise and escape some of its settingsCVE-2023-5940 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Not Login Hide (WPNLH) WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Not Login Hide (WPNLH)
Affected
up to 1.0
What to do
Affects up to 1.0. Update WP Not Login Hide (WPNLH) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023File Manager: Does not restrict the file managers root directoryCVE-2023-5907 · WordPress plugins & themes · reported by WPScanMedium 6.5
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowed to modify the sites files.
Product
File Manager
Fixed in
6.3
What to do
Update File Manager to 6.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023WP Crowdfunding: Does not sanitise and escape some of its settingsCVE-2023-5757 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP Crowdfunding WordPress plugin before 2.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WP Crowdfunding
Fixed in
2.1.8
What to do
Update WP Crowdfunding to 2.1.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023EmbedPress: Does not sanitise and escape a parameter before outputting it back in the page containing a specific contentCVE-2023-5750 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape a parameter before outputting it back in the page containing a specific content, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EmbedPress
Fixed in
3.9.2
What to do
Update EmbedPress to 3.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 11, 2023EmbedPress: Does not sanitise and escape user input before outputting it back in the pageCVE-2023-5749 · WordPress plugins & themes · reported by WPScanMedium 6.1
The EmbedPress WordPress plugin before 3.9.2 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
EmbedPress
Fixed in
3.9.2
What to do
Update EmbedPress to 3.9.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023WP Fastest Cache: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-6063 · WordPress plugins & themes · reported by WPScanHigh 7.5
The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Product
WP Fastest Cache
Fixed in
1.2.2
What to do
Update WP Fastest Cache to 1.2.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor: Does not have CSRF checks on some of its form actions suchCVE-2023-5990 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor WordPress plugin before 3.4.2 does not have CSRF checks on some of its form actions such as deletion and duplication, which could allow attackers to make logged in admin perform such actions via CSRF attacks
Product
Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor
Fixed in
3.4.2
What to do
Update Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor to 3.4.2 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023eCommerce Product Catalog Plugin for: Does not have CSRF checks in some of its admin pagesCVE-2023-5979 · WordPress plugins & themes · reported by WPScanMedium 6.5
The eCommerce Product Catalog Plugin for WordPress plugin before 3.3.26 does not have CSRF checks in some of its admin pages, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as delete all products
Product
eCommerce Product Catalog Plugin for
Fixed in
3.3.26
What to do
Update eCommerce Product Catalog Plugin for to 3.3.26 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Welcart e-Commerce: Does not validate files to be uploadedCVE-2023-5953 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Welcart e-Commerce WordPress plugin before 2.9.5 does not validate files to be uploaded, as well as does not have authorisation and CSRF in an AJAX action handling such upload. As a result, any authenticated users, such as subscriber could upload arbitrary files, such as PHP on the server
Product
Welcart e-Commerce
Fixed in
2.9.5
What to do
Update Welcart e-Commerce to 2.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Welcart e-Commerce: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5951 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Welcart e-Commerce WordPress plugin before 2.9.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Welcart e-Commerce
Fixed in
2.9.5
What to do
Update Welcart e-Commerce to 2.9.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Word Balloon: Does not protect some of its actions against CSRF attacksCVE-2023-5884 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link.
Product
Word Balloon
Fixed in
4.20.3
What to do
Update Word Balloon to 4.20.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5874 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Popup box
Fixed in
3.8.6
What to do
Update Popup box to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5809 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
Popup box
Fixed in
3.8.6
What to do
Update Popup box to 3.8.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023AMP+ Plus: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5210 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AMP+ Plus WordPress plugin through 3.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
AMP+ Plus
Affected
up to 3.0
What to do
Affects up to 3.0. Update AMP+ Plus to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023BSK Contact Form 7 Blacklist: Does not sanitise and escape the inserted_count parameter before outputting it back in the pageCVE-2023-5141 · WordPress plugins & themes · reported by WPScanMedium 6.1
The BSK Contact Form 7 Blacklist WordPress plugin through 1.0.1 does not sanitise and escape the inserted_count parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
BSK Contact Form 7 Blacklist
Affected
up to 1.0.1
What to do
Affects up to 1.0.1. Update BSK Contact Form 7 Blacklist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Simply Excerpts: Does not sanitize and escape some fields in the plugin settingsCVE-2023-5137 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Simply Excerpts WordPress plugin through 1.4 does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Product
Simply Excerpts
Affected
up to 1.4
What to do
Affects up to 1.4. Update Simply Excerpts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Easy Newsletter Signups: Does not properly sanitise and escape a parameter before using it in a SQL statementCVE-2023-5108 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Easy Newsletter Signups WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Product
Easy Newsletter Signups
Affected
up to 1.0.4
What to do
Affects up to 1.0.4. Update Easy Newsletter Signups to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 4, 2023Uploading SVG, WEBP and ICO files: Does not sanitise uploaded SVG filesCVE-2023-4460 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
Product
Uploading SVG, WEBP and ICO files
Affected
up to 1.2.1
What to do
Affects up to 1.2.1. Update Uploading SVG, WEBP and ICO files to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023POST SMTP Mailer: Does not escape email message content before displaying it in the backendCVE-2023-5958 · WordPress plugins & themes · reported by WPScanMedium 6.1
The POST SMTP Mailer WordPress plugin before 2.7.1 does not escape email message content before displaying it in the backend, allowing an unauthenticated attacker to perform XSS attacks against highly privileged users.
Product
POST SMTP Mailer
Fixed in
2.7.1
What to do
Update POST SMTP Mailer to 2.7.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Medialist: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-5942 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Medialist
Fixed in
1.4.1
What to do
Update Medialist to 1.4.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Backup & Migration: Does not sanitise and escape some parametersCVE-2023-5738 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Backup & Migration: Does not authorize some AJAX requestsCVE-2023-5737 · WordPress plugins & themes · reported by WPScanMedium 4.3
The WordPress Backup & Migration WordPress plugin before 1.4.4 does not authorize some AJAX requests, allowing users with a role as low as Subscriber to update some plugin settings.
Product
WordPress Backup & Migration
Fixed in
1.4.4
What to do
Update WordPress Backup & Migration to 1.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WassUp Real Time Analytics: Does not escape IP address provided via some headers before outputting them back in an admin pageCVE-2023-5653 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WassUp Real Time Analytics WordPress plugin through 1.9.4.5 does not escape IP address provided via some headers before outputting them back in an admin page, allowing unauthenticated users to perform Stored XSS attacks against logged in admins
Product
WassUp Real Time Analytics
Affected
up to 1.9.4.5
What to do
Affects up to 1.9.4.5. Update WassUp Real Time Analytics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Martins Free & Easy SEO BackLink Link Building Network: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5641 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Martins Free & Easy SEO BackLink Link Building Network WordPress plugin before 1.2.30 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Martins Free & Easy SEO BackLink Link Building Network
Fixed in
1.2.30
What to do
Update Martins Free & Easy SEO BackLink Link Building Network to 1.2.30 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Web Push Notifications: Does not prevent visitors on the site from changing some of the plugin optionsCVE-2023-5620 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Web Push Notifications WordPress plugin before 4.35.0 does not prevent visitors on the site from changing some of the plugin options, some of which may be used to conduct Stored XSS attacks.
Product
Web Push Notifications
Fixed in
4.35.0
What to do
Update Web Push Notifications to 4.35.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Seraphinite Accelerator: Does not have authorisation and CSRF checksCVE-2023-5611 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting and importing its settings, allowing unauthenticated users to reset them
Product
Seraphinite Accelerator
Fixed in
2.20.32
What to do
Update Seraphinite Accelerator to 2.20.32 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WP-UserOnline: Does not sanitise and escape the X-Forwarded-For header before outputting its content on the pageCVE-2023-5560 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-UserOnline WordPress plugin before 2.88.3 does not sanitise and escape the X-Forwarded-For header before outputting its content on the page, which allows unauthenticated users to perform Cross-Site Scripting attacks.
Product
WP-UserOnline
Fixed in
2.88.3
What to do
Update WP-UserOnline to 2.88.3 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 202310Web Booster: Does not validate the option name given to some AJAX actionsCVE-2023-5559 · WordPress plugins & themes · reported by WPScanCritical 9.1
The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to delete arbitrary options from the database, leading to denial of service.
Product
10Web Booster
Fixed in
2.24.18
What to do
Update 10Web Booster to 2.24.18 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSSCVE-2023-5325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Woocommerce Vietnam Checkout WordPress plugin before 2.0.6 does not escape the custom shipping phone field no the checkout form leading to XSS
Product
Woocommerce Vietnam Checkout
Fixed in
2.0.6
What to do
Update Woocommerce Vietnam Checkout to 2.0.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023WordPress Online Booking and Scheduling: Does not sanitise and escape some of its settingsCVE-2023-5209 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
WordPress Online Booking and Scheduling
Fixed in
22.5
What to do
Update WordPress Online Booking and Scheduling to 22.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023kk Star Ratings: Does not implement atomic operationsCVE-2023-4642 · WordPress plugins & themes · reported by WPScanMedium 5.9
The kk Star Ratings WordPress plugin before 5.4.6 does not implement atomic operations, allowing one user vote multiple times on a poll due to a Race Condition.
Product
kk Star Ratings
Fixed in
5.4.6
What to do
Update kk Star Ratings to 5.4.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Mmm Simple File List: Does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedCVE-2023-4514 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Product
Mmm Simple File List
Affected
up to 2.3
What to do
Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023Mmm Simple File List: Does not validate the generated path to list files fromCVE-2023-4297 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Mmm Simple File List WordPress plugin through 2.3 does not validate the generated path to list files from, allowing any authenticated users, such as subscribers, to list the content of arbitrary directories.
Product
Mmm Simple File List
Affected
up to 2.3
What to do
Affects up to 2.3. Update Mmm Simple File List to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 27, 2023gAppointments: Does not sanitise and escape some of its settingsCVE-2023-2707 · WordPress plugins & themes · reported by WPScanMedium 4.8
The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
gAppointments
Affected
up to 1.9.5.1
What to do
Affects up to 1.9.5.1. Update gAppointments to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023WP Hotel Booking: Does not have proper authorisationCVE-2023-5799 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete posts that do no belong to them
Product
WP Hotel Booking
Fixed in
2.0.8
What to do
Update WP Hotel Booking to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023WP Hotel Booking: Does not have authorisation and CSRF checksCVE-2023-5652 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL statement of a function hooked to admin_init, allowing unauthenticated users to perform SQL injections
Product
WP Hotel Booking
Fixed in
2.0.8
What to do
Update WP Hotel Booking to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023WP Hotel Booking: Does not have authorisation and CSRF checksCVE-2023-5651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a package, allowing any authenticated users, such as subscriber to delete arbitrary posts
Product
WP Hotel Booking
Fixed in
2.0.8
What to do
Update WP Hotel Booking to 2.0.8 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauCVE-2023-5640 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection vulnerability.
Affected
up to 1.0
What to do
Affects up to 1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record devl00p.github.io wpscan.com
Nov 20, 2023Seraphinite Accelerator: Does not validate the URL to redirect any authenticated user toCVE-2023-5610 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect
Product
Seraphinite Accelerator
Fixed in
2.2.29
What to do
Update Seraphinite Accelerator to 2.2.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Seraphinite Accelerator: Does not sanitise and escape a parameter before outputting it back in the pageCVE-2023-5609 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Product
Seraphinite Accelerator
Fixed in
2.2.29
What to do
Update Seraphinite Accelerator to 2.2.29 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023myStickymenu: Does not adequately authorize some ajax callsCVE-2023-5509 · WordPress plugins & themes · reported by WPScanMedium 5.4
The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions.
Product
myStickymenu
Fixed in
2.6.5
What to do
Update myStickymenu to 2.6.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 20, 2023Popup box: Does not sanitise and escape some of its settingsCVE-2023-5343 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Product
Popup box
Fixed in
3.7.9
What to do
Update Popup box to 3.7.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.